-
Cisco Security Appliance Command Reference, Version 8.0
-
About This Guide
-
Using the Command Line Interface
- A through B Commands
- C Commands
- D through F Commands
- G through I Commands
- J through L Commands
- M through O Commands
- P though R Commands
-
S Commands
-
same-security-traffic -- show asdm sessions
-
show asp drop -- show curpriv
-
show ddns -- show ipv6 traffic
-
show isakmp sa -- show route
-
show running-config -- show running-config isakmp
-
show running-config ldap -- show running-config webvpn auto-signon
-
show service-policy -- show xlate
-
shun -- sysopt radius ignore-secret
-
- T through Z Commands
-
Table Of Contents
cache through clear compression Commands
cipc security-mode authenticated
clear aaa local user fail-attempts
cache through clear compression Commands
cache
To enter cache mode and set values for caching attributes, enter the cache command in webvpn configuration mode. To remove all cache related commands from the configuration and reset them to their default values, enter the no version of this command.
cache
no cache
Defaults
Enabled with default settings for each cache attribute.
Command Modes
The following table shows the modes in which you enter the command:
Webvpn configuration
•
—
•
—
—
Command History
Usage Guidelines
Caching stores frequently reused objects in the system cache, which reduces the need to perform repeated rewriting and compressing of content. It reduces traffic between WebVPN and both the remote servers and end-user browsers, with the result that many applications run much more efficiently.
Examples
The following example shows how to enter cache mode:
hostname(config)# webvpnhostname(config-webvpn)# cachehostname(config-webvpn-cache)#Related Commands
cache-fs limit
To limit the size of the cache file system used to store images that the security appliance downloads to remote PCs, use the cache-fs limit command from webvpn configuration mode. Use the no form of this commandto return to the default value.
cache-fs limit {size}
no cache-fs limit {size}
Syntax Description
Defaults
The default value is 20 MB.
Command Modes
The following table shows the modes in which you can enter the command:
Webvpn configuration
•
—
•
—
—
Command History
Usage Guidelines
The security appliance expands package files containing images and files for the Cisco AnyConnect VPN Client and Cisco Secure Desktop (CSD) in cache memory for downloading to remote PCs. For the security appliance to successfully expand the package files, there must be enough cache memory to store the images and files.
If the security appliance detects there is not enough cache memory to expand a package, it displays an error message to the console. The following example shows an error message reported after an attempt to install an AnyConnect VPN Client image package with the svc image command:
hostname(config-webvpn)# svc image disk0:/vpn-win32-Release-2.0-k9.pkgERROR: File write error (check disk space)ERROR: Unable to load SVC image - extraction failedIf this occurs when you attempt to install an image package, you can examine the amount of cache memory remaining and the size of any previously installed packages with the dir cache:/ command from global configuration mode. Then you can adjust the cache size limit accordingly.
Examples
The following example indicates the CSD image (located in sdesktop) and the CVC image (located in stc) use approximately 5.44 MB of cache memory:
hostname(config-webvpn)# dir cache:/Directory of cache:/0 drw- 0 17:06:55 Nov 13 2006 sdesktop0 drw- 0 16:46:54 Nov 13 2006 stc5435392 bytes total (4849664 bytes free)The next example limits the cache size to 6 MB:
hostname(config-webvpn)# cache-fs limit 6Related Commands
cache-time
To specify in minutes how long to allow a CRL to remain in the cache before considering it stale, use the cache-time command in crl configure configuration mode, which is accessible from crypt ca trustpoint configuration mode. To return to the default value, use the no form of this command.
cache-time refresh-time
no cache-time
Syntax Description
refresh-time
Specifies the number of minutes to allow a CRL to remain in the cache. The range is 1 - 1440 minutes. If the NextUpdate field is not present in the CRL, the CRL is not cached.
Defaults
The default setting is 60 minutes.
Command Modes
The following table shows the modes in which you can enter the
Crl configure configuration
•
•
•
•
•
command:
Command History
Examples
The following example enters ca-crl configuration mode, and specifies a cache time refresh value of 10 minutes for trustpoint central:
hostname(configure)# crypto ca trustpoint centralhostname(ca-trustpoint)# crl configurehostname(ca-crl)# cache-time 10hostname(ca-crl)#Related Commands
call-agent
To specify a group of call agents, use the call-agent command in MGCP map configuration mode, which is accessible by using the mgcp-map command. To remove the configuration, use the no form of this command.
call-agent ip_address group_id
no call-agent ip_address group_id
Syntax Description
ip_address
The IP address of the gateway.
group_id
The ID of the call agent group, from 0 to 2147483647.
Defaults
This command is disabled by default.
Command Modes
The following table shows the modes in which you can enter the command:
Global configuration
•
•
•
•
—
Command History
Usage Guidelines
Use the call-agent command to specify a group of call agents that can manage one or more gateways. The call agent group information is used to open connections for the call agents in the group (other than the one a gateway sends a command to) so that any of the call agents can send the response. Call agents with the same group_id belong to the same group. A call agent may belong to more than one group. The group_id option is a number from 0 to 4294967295. The ip_address option specifies the IP address of the call agent.
Examples
The following example allows call agents 10.10.11.5 and 10.10.11.6 to control gateway 10.10.10.115, and allows call agents 10.10.11.7 and 10.10.11.8 to control both gateways 10.10.10.116 and 10.10.10.117:
hostname(config)# mgcp-map mgcp_inboundhostname(config-mgcp-map)# call-agent 10.10.11.5 101hostname(config-mgcp-map)# call-agent 10.10.11.6 101hostname(config-mgcp-map)# call-agent 10.10.11.7 102hostname(config-mgcp-map)# call-agent 10.10.11.8 102hostname(config-mgcp-map)# gateway 10.10.10.115 101hostname(config-mgcp-map)# gateway 10.10.10.116 102hostname(config-mgcp-map)# gateway 10.10.10.117 102Related Commands
call-duration-limit
To configure the call duration for an H.323 call, use the call-duration-limit command in parameters configuration mode, which is accessible from policy-map configuration mode. To disable this feature, use the no form of this command.
call-duration-limit hh:mm:ss
no call-duration-limit hh:mm:ss
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Parameters configuration
•
•
•
•
—
Command History
Examples
The following example shows how to configure the call duration for an H.323 call:
hostname(config)# policy-map type inspect h323 h323_maphostname(config-pmap)# parametershostname(config-pmap-p)# call-duration-limit 0:1:0Related Commands
call-party-numbers
To enforce sending call party numbers during an H.323 call setup, use the call-party-numbers command in parameters configuration mode, which is accessible from policy-map configuration mode. To disable this feature, use the no form of this command.
call-party-numbers
no call-party-numbers
Syntax Description
This command has no arguments or keywords.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Parameters configuration
•
•
•
•
—
Command History
Examples
The following example shows how to enforce call party numbers during call setup for an H.323 call:
hostname(config)# policy-map type inspect h323 h323_maphostname(config-pmap)# parametershostname(config-pmap-p)# call-party-numbersRelated Commands
capture
To enable packet capture capabilities for packet sniffing and network fault isolation, use the capture command in privileged EXEC mode. To disable packet capture capabilities, use the no form of this command.
capture capture_name [type {asp-drop all [drop-code] | raw-data | isakmp | decrypted | webvpn user webvpn-user [url url]}] [access-list access_list_name] [buffer buf_size] [ethernet-type type] [interface interface_name] [packet-length bytes] [circular-buffer] [trace trace_count] [real-time] [dump] [detail] [trace] [match prot {host source-ip | source-ip mask | any}{host destination-ip | destination-ip mask | any} [operator port]
no capture capture-name [type {asp-drop [drop-code] | raw-data | isakmp | decrypted | webvpn user webvpn-user] [access-list access_list_name] [circular-buffer] [interface interface_name] [real-time] [dump] [detail] [trace] [match prot] {host source-ip | source-ip mask | any}{host destination-ip | destination-ip mask | any} [operator port]
Syntax Description
Defaults
The defaults are as follows:
•
•
•
•
Command Modes
The following table shows the modes in which you can enter the command:
Priveleged EXEC
•
•
•
•
•
Command History
Usage Guidelines
Capturing packets is useful when troubleshooting connectivity problems or monitoring suspicious activity. You can create multiple captures. To view the packet capture, use the show capture name command. To save the capture to a file, use the copy capture command. Use the https://security appliance-ip-address/admin/capture/capture_name[/pcap] command to see the packet capture information with a web browser. If you specify the pcap optional keyword, then a libpcap-format file is downloaded to the web browser and can be saved using the web browser. (A libcap file can be viewed with TCPDUMP or Ethereal.)
If you copy the buffer contents to a TFTP server in ASCII format, you will see only the headers, not the details and hexadecimal dump of the packets. To see the details and hexadecimal dump, you need to transfer the buffer in PCAP format and read it with TCPDUMP or Ethereal.
Note
Entering no capture without optional keywords deletes the capture. If the access-list optional keyword is specified, the access list is removed from the capture and the capture is preserved. If the interface keyword is specified, the capture is detached from the specified interface and the capture is preserved. Enter the no capture command with either the access-list or interface optional keyword unless you want to clear the capture itself.
You cannot perform any operations on a capture while the real-time display is in progress. Using the real-time keyword with a slow console connection may result in an excessive number of non-displayed packets because of performance considerations. The fixed limit of the buffer is 1000 packets. If the buffer fills up, a counter is maintained of the captured packets. If you open another session, you can disable the real-time display be entering the no capture real-time command.
Note
Examples
To capture a packet, enter the following command:
hostname# capture captest interface insidehostname# capture captest interface outsideOn a web browser, the contents of the capture command that was issued, named "captest", can be viewed at the following location:
https://171.69.38.95/admin/capture/captestTo download a libpcap file (which web browsers use) to a local machine, enter the following command:
https://171.69.38.95/capture/http/pcapThe following example shows that the traffic is captured from an outside host at 171.71.69.234 to an inside HTTP server:
hostname# access-list http permit tcp host 10.120.56.15 eq http host 171.71.69.234hostname# access-list http permit tcp host 171.71.69.234 host 10.120.56.15 eq httphostname# capture http access-list http packet-length 74 interface insideThe following example shows how to capture ARP packets:
hostname# capture arp ethernet-type arp interface outsideThe following example inserts five tracer packets into the data stream, where access-list 101 defines traffic that matches TCP protocol FTP :
hostname# capture ftptrace interface outside access-list 101 trace 5To view the traced packets and information about packet processing in an easily readable manner, use the show capture ftptrace command.
This example shows how to display captured packets in real-time:
hostname# capture test interface outside real-timeWarning: Using this option with a slow console connection may result in an excess amount of non-displayed packets due to performance limitations.Use ctrl-c to terminate real-time capture.10 packets displayed12 packets not displayed due to performance limitationsRelated Commands
clear capture
Clears the capture buffer.
copy capture
Copies a capture file to a server.
show capture
Displays the capture configuration when no options are specified.
cd
To change the current working directory to the one specified, use the cd command in privileged EXEC mode.
cd [disk0: | disk1: | flash:] [path]
Syntax Description
Defaults
If you do not specify a directory, the directory is changed to the root directory.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
—
•
Command History
Examples
This example shows how to change to the "config" directory:
hostname# cd flash:/config/Related Commands
cdp-url
To specify the CDP to be included in certificates issued by the local CA, use the cdp-url command in CA server configuration mode. To revert to the default CDP, use the no form of this command.
[no] cdp-url url
Syntax Description
url
Specifies the URL where a validating party obtains revocation status for certificates issued by the local CA. The URL must be less than 500 alphanumeric characters.
Defaults
The default CDP URL is that of the security appliance that includes the local CA. The default URL is in the format: http://hostname.domain/+CSCOCA+/asa_ca.crl
Command Modes
The following table shows the modes in which you can enter the command:
CA server configuration
•
—
•
—
—
Command History
Usage Guidelines
The CDP is an extension that can be included in issued certificates to specify the location where a validating party can obtain revocation status for the certificate. Only one CDP can be configured at a time.
Note
Examples
The following example configures a CDP at 10.10.10.12 for certificates issued by the local CA server:
hostname(config)# crypto ca serverhostname(config-ca-server)# cdp-url http://10.10.10.12/ca/crlhostname(config-ca-server)#Related Commands
certificate
Use the certificate command in crypto ca certificate chain configuration mode to add the indicated certificate. Whenthis command is issued, the security appliance interprets the data included with it as the certificate in hexadecimal format. A quit string indicates the end of the certificate. To delete the certificate, use the no form of this command.
certificate [ca | ra-encrypt | ra-sign | ra-general] certificate-serial-number
no certificate certificate-serial-number
Syntax Description
Syntax DescriptionSyntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Crypto ca certificate chain configuration
•
•
•
•
•
Command History
Usage Guidelines
A CA is an authority in a network that issues and manages security credentials and public key for message encryption. As part of a public key infrastructure, a CA checks with a RA to verify information provided by the requestor of a digital certificate. If the RA verifies the requestor information, the CA can then issue a certificate.
Examples
The following example adds a CA certificate with a serial number 29573D5FF010FE25B45:
hostname(config)# crypto ca trustpoint centralhostname(ca-trustpoint)# crypto ca certificate chain centralhostname(ca-cert-chain)# certificate ca 29573D5FF010FE25B4530820345 308202EF A0030201 02021029 572A3FF2 96EF854F D0D6732F E25B45300D06092A 864886F7 0D010105 05003081 8F311630 1406092A 864886F7 0D01090116076140 622E636F 6D310B30 09060355 04061302 55533116 30140603 550408130D6D6173 73616368 75736574 74733111 300F0603 55040713 08667261 6E6B6C696E310E30 0C060355 040A1305 63697363 6F310F30 0D060355 040B1306 726F6F746F75311C 301A0603 55040313 136D732D 726F6F74 2D736861 2D30362D 32303031301E170D 30313036 32363134 31313430 5A170D32 32303630 34313430 3133305A30818F31 16301406 092A8648 86F70D01 09011607 6140622E 636F6D31 0B30090603550406 13025553 31163014 06035504 08130D6D 61737361 63687573 657474733111300F 06035504 07130866 72616E6B 6C696E31 0E300C06 0355040A 1305636973636F31 0F300D06 0355040B 1306726F 6F746F75 311C301A 06035504 0313136D732D726F 6F742D73 68612D30 362D3230 3031305C 300D0609 2A864886 F70D010101050003 4B003048 024100AA 3EB9859B 8670A6FB 5E7D2223 5C11BCFE 48E6D3A8181643ED CF7E75EE E77D83DF 26E51876 97D8281E 9F58E4B0 353FDA41 29FC791B1E14219C 847D19F4 A51B7B02 03010001 A3820123 3082011F 300B0603 551D0F0404030201 C6300F06 03551D13 0101FF04 05300301 01FF301D 0603551D 0E04160414E0D412 3ACC96C2 FBF651F3 3F66C0CE A62AB63B 323081CD 0603551D 1F0481C53081C230 3EA03CA0 3A86386C 6461703A 2F2F7732 6B616476 616E6365 647372762F436572 74456E72 6F6C6C2F 6D732D72 6F6F742D 7368612D 30362D32 3030312E63726C30 3EA03CA0 3A863868 7474703A 2F2F7732 6B616476 616E6365 647372762F436572 74456E72 6F6C6C2F 6D732D72 6F6F742D 7368612D 30362D32 3030312E63726C30 40A03EA0 3C863A66 696C653A 2F2F5C5C 77326B61 6476616E 6365647372765C43 65727445 6E726F6C 6C5C6D73 2D726F6F 742D7368 612D3036 2D323030312E6372 6C301006 092B0601 04018237 15010403 02010130 0D06092A 864886F70D010105 05000341 0056221E 03F377B9 E6900BF7 BCB3568E ADBA146F 3B8A71F3DF9EB96C BB1873B2 B6268B7C 0229D8D0 FFB40433 C8B3CB41 0E4D212B 2AEECD77BEA3C1FE 5EE2AB6D 91quitRelated Commands
